Updated ssl pinning mode to have default pinned certificates by default

azureatom · Sep 29, 2013 · 4350a01 · 4350a01
1 parent 9e71033
commit 4350a01
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/AFNetworking/AFSecurityPolicy.m b/AFNetworking/AFSecurityPolicy.m
@@ -154,6 +154,7 @@ + (instancetype)defaultPolicy {
 + (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode {
     AFSecurityPolicy *securityPolicy = [[self alloc] init];
     securityPolicy.SSLPinningMode = pinningMode;
+    [securityPolicy setPinnedCertificates:[self defaultPinnedCertificates]];
 
     return securityPolicy;
 }

diff --git a/Example/Classes/AFAppDotNetAPIClient.m b/Example/Classes/AFAppDotNetAPIClient.m
@@ -31,6 +31,7 @@ + (instancetype)sharedClient {
     static dispatch_once_t onceToken;
     dispatch_once(&onceToken, ^{
         _sharedClient = [[AFAppDotNetAPIClient alloc] initWithBaseURL:[NSURL URLWithString:AFAppDotNetAPIBaseURLString]];
+        [_sharedClient setSecurityPolicy:[AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey]];
     });
 
     return _sharedClient;

diff --git a/Tests/Tests/AFSecurityPolicyTests.m b/Tests/Tests/AFSecurityPolicyTests.m
@@ -165,4 +165,14 @@ - (void)testPolicyWithPinningModeIsSetToNotAllowInvalidSSLCertificates {
     XCTAssert(policy.allowInvalidCertificates == NO, @"policyWithPinningMode: should not allow invalid ssl certificates by default.");
 }
 
+- (void)testThatSSLPinningPolicyClassMethodContainsDefaultCertificates{
+    AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
+    XCTAssertNotNil(policy.pinnedCertificates, @"Default certificate array should not be empty for SSL pinning mode policy");
+}
+
+- (void)testThatDefaultPinningPolicyClassMethodContainsNoDefaultCertificates{
+    AFSecurityPolicy *policy = [AFSecurityPolicy defaultPolicy];
+    XCTAssertNil(policy.pinnedCertificates, @"Default certificate array should be empty for default policy.");
+}
+
 @end